oclif-dev

{"modified":"2025-12-02T09:12:16Z","published":"2025-08-29T18:55:03Z","schema_version":"1.7.4","id":"MAL-2025-42049","summary":"Malicious code in oclif-dev (npm)","details":"The package oclif-dev was found to contain malicious code.\n\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: google-open-source-security (9cf078178f5da45231528dbb9bb1883266f18b9c8cd4784a7c8542a3c3d4de7b)\nThis package installs a dependency hosted on a custom domain that runs an\ninfo stealer during installation. The info stealer focuses on stealing\nnpm, git, and other CI/CD related tokens.\n","affected":[{"package":{"ecosystem":"npm","name":"oclif-dev"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"}]}],"versions":["99.0.0"]}],"references":[{"type":"WEB","url":"https://www.koi.ai/blog/phantomraven-npm-malware-hidden-in-invisible-dependencies"},{"type":"WEB","url":"https://www.sonatype.com/blog/phantomraven-npm-malware"}],"credits":[{"name":"Amazon Inspector","type":"FINDER","contact":["actran@amazon.com"]},{"name":"ReversingLabs","type":"FINDER","contact":["https://www.reversinglabs.com"]}],"database_specific":{"malicious-packages-origins":[{"source":"reversing-labs","sha256":"10cfeb2505ac779f44f00756dd80ffbab895892b867d7a5d23748259c01832f8","import_time":"2025-09-26T11:05:59.889374093Z","id":"RLMA-2025-05100","modified_time":"2025-09-26T09:38:16Z","versions":["99.0.0"]},{"source":"google-open-source-security","sha256":"9cf078178f5da45231528dbb9bb1883266f18b9c8cd4784a7c8542a3c3d4de7b","import_time":"2025-10-30T03:28:38.884247Z","modified_time":"2025-10-30T03:28:23Z","versions":["99.0.0"]},{"source":"reversing-labs","sha256":"a2e897b4dcc2503c353e7c0b2ef1df695b3b86a4b03841a9005620b6ba2e776a","import_time":"2025-12-02T09:10:09.518948481Z","id":"RLUA-2025-05899","modified_time":"2025-12-01T13:19:35Z"}]}}